skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-ot-network-security-assessment

Assess OT network security by analyzing Purdue model segmentation, firewall rules, and industrial protocol traffic.

954|172|Updated Mar 13, 2026
Search Tags:#network assessment#Modbus#iec 62443#SCADA#ICS#purdue model#OT security
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-ot-network-security-assessment
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-ot-network-security-assessment
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ot-ics-security/performing-ot-network-security-assessment
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-ot-network-security-assessment

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires scapy, opcua.

What problem does it solve?

OT and ICS environments require security assessments that cannot rely on aggressive IT-style scanning, since active probes can crash PLCs and disrupt safety systems. This Skill provides a safe, passive-first methodology for baselining industrial networks, evaluating zone segmentation, and detecting unauthorized cross-zone communication aligned with IEC 62443 and NIST SP 800-82.

Core Features & Use Cases

  • Passive Asset Discovery: Analyze pcap captures with Scapy to inventory OT assets, classify them by Purdue level, and map industrial protocols such as Modbus, DNP3, OPC UA, and EtherNet/IP.
  • Firewall Rule Analysis: Parse firewall rule exports and evaluate them against IEC 62443 zone/conduit policy to find prohibited conduits, overly permissive any/any rules, and unauthorized ports.
  • Protocol Security Checks: Use tshark and OPC UA endpoint enumeration to detect unauthenticated Modbus write commands and weak security policies.
  • Use Case: A consultant assessing a chemical plant captures two weeks of SPAN traffic, runs the discovery script to find a Level 4 workstation communicating directly with a Level 1 PLC, and reports it as a critical segmentation failure with remediation steps.

Quick Start

Ask the assistant to perform an OT network security assessment on the provided pcap capture and firewall rules export, then generate an IEC 62443-aligned findings report.

Frequently Asked Questions about performing-ot-network-security-assessment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform an OT network security assessment without disrupting operations?▼

Use passive monitoring via SPAN ports to capture traffic for 2-4 weeks, then analyze it with Scapy or Wireshark to inventory assets and map protocols. Restrict active scanning to Level 2 and above during approved maintenance windows, never against PLCs or safety systems.

How to detect unauthorized cross-zone traffic in a Purdue model network?▼

Analyze captured packets by classifying source and destination IPs into Purdue levels and flagging flows between levels, such as Level 4 enterprise hosts reaching Level 1 controllers. The discovery script reports these as critical or high findings automatically.

What tools are used for passive ICS network discovery?▼

Common tools include Wireshark/tshark with industrial protocol dissectors, Scapy for pcap analysis, and platforms like Nozomi Guardian, Dragos, or Claroty xDome. Grassmarlin provides passive topology mapping for SCADA networks.

Can I run nmap scans against PLCs during an OT assessment?▼

No, active SYN scans can hang legacy PLC TCP stacks and disrupt safety instrumented systems. Limit nmap to Level 2+ systems during maintenance windows with explicit authorization, and rely on passive fingerprinting for Level 0-1 devices.

How do I check if Modbus writes are unauthenticated on my network?▼

Capture traffic on port 502 and filter with tshark for Modbus function codes 5, 6, 15, and 16, which represent write operations. Their presence in normal traffic confirms unauthenticated writes are occurring, since Modbus/TCP has no built-in authentication.

When should this OT assessment approach not be used?▼

Do not use it for IT-only networks without OT components, for web application penetration testing, or for active exploitation of live OT systems without written authorization and safety controls. It is designed for passive-first assessment of industrial environments.

Related Skills

Explore More Software Engineering Skills→
DCx7C5DCx7C5

otsafescan-SKILL.md

Identify and assess OT vulnerabilities in industrial networks with passive monitoring and controlled active checks.

Community
Advanced
drupadsachaniadrupadsachania

operational-technology

Automate OT/ICS risk assessment, asset discovery, and security governance.

Community
Advanced
Ed1s0nZEd1s0nZ
5.6k

network-penetration-testing

Execute network penetration testing phases with Nmap, Nessus, and Metasploit.

Community
Advanced
litestar-orglitestar-org
13

polyfactory

Generate validation-passing mock data for Litestar models across Pydantic, msgspec, dataclasses, attrs, and SQLAlchemy.

Official
Intermediate